Skip to content

Commit 65d557d

Browse files
authored
PEP 770: Move 'Selecting a single SBOM standard' to rejected ideas (#4228)
1 parent 3cf28aa commit 65d557d

File tree

1 file changed

+18
-7
lines changed

1 file changed

+18
-7
lines changed

peps/pep-0770.rst

Lines changed: 18 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -409,6 +409,24 @@ is not constrained to select a single SBOM standard by its consumers and thus
409409
can allow tools creating SBOM documents for inclusion in Python packages to
410410
choose which SBOM standard works best for their use-case.
411411

412+
Rejected Ideas
413+
==============
414+
415+
Selecting a single SBOM standard
416+
--------------------------------
417+
418+
There is no universally accepted SBOM standard and this area is still
419+
rapidly evolving (for example, SPDX released a new major version of their
420+
standard in April 2024). To avoid locking the Python ecosystem into a specific
421+
standard ahead of when a clear winner emerges this PEP treats SBOM documents
422+
as opaque and only makes recommendations to promote compatibility with
423+
downstream consumers of SBOM document data.
424+
425+
None of the decisions in this PEP restrict a future PEP to select
426+
a single SBOM standard. Tools that use SBOM data today already need to support
427+
multiple formats to handle this situation, so a future standard that updates to
428+
require only one standard would have no effect on downstream SBOM tools.
429+
412430
Open Issues
413431
===========
414432

@@ -417,13 +435,6 @@ Conditional project source SBOM files
417435

418436
How can a project specify an SBOM file that is conditional? Under what circumstances would an SBOM document be conditional?
419437

420-
Selecting a single SBOM standard
421-
--------------------------------
422-
423-
Should this PEP select a single SBOM standard instead of supporting any
424-
SBOM standard? Selecting a single standard would potentially limit the
425-
evolution of SBOM standards which is an active area of development.
426-
427438
References
428439
==========
429440

0 commit comments

Comments
 (0)